CVE-2026-16272
Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API (v9x) WHMCS Module: from v9.0.0 before v9.0.3.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- EPSS probability
- 0.14%
- CWE
- CWE-348
- Published
- 2026-09-09
- Last modified
- 2026-09-09
Affected products
- PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module
Weakness type
Related vulnerabilities
- CVE-2026-16732 — fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
- CVE-2026-25552 — Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header
- CVE-2026-63220 — CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()
- CVE-2026-50243 — 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL
- CVE-2026-63770 — Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypass
- CVE-2026-64619 — FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers
- CVE-2026-46415 — Caddy Defender trusted proxy client IP bypass
- CVE-2026-9561 — Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the...